SERVICE AUTOMATION AND DYNAMIC PROVISIONING TECHNIQUES IN IP/MPLS ENVIRONMENTS

Transcription

1 SERVICE AUTOMATION AND DYNAMIC PROVISIONING TECHNIQUES IN IP/MPLS ENVIRONMENTS Christian Jacquenet, Gilles Bourdon and Mohamed Boucadair All at France Telecom, France

2

3 SERVICE AUTOMATION AND DYNAMIC PROVISIONING TECHNIQUES IN IP/MPLS ENVIRONMENTS

4 WILEY SERIES IN COMMUNICATIONS NETWORKING & DISTRIBUTED SYSTEMS Series Editor: Series Advisers: David Hutchison, Lancaster University, Lancaster, UK Serge Fdida, Université Pierre et Marie Curie, Paris, France Joe Sventek, University of Glasgow, Glasgow, UK The Wiley Series in Communications Networking & Distributed Systems is a series of expert-level, technically detailed books covering cutting-edge research, and brand new developments as well as tutorial-style treatments in networking, middleware and software technologies for communications and distributed systems. The books will provide timely and reliable information about the state-of-the-art to researchers, advanced students and development engineers in the Telecommunications and the Computing sectors. Other titles in the series: Wright: Voice over Packet Networks (February 2001) Jepsen: Java for Telecommunications (July 2001) Sutton: Secure Communications (December 2001) Stajano: Security for Ubiquitous Computing (February 2002) Martin-Flatin: Web-Based Management of IP Networks and Systems, (September 2002) Berman, Fox, Hey: Grid Computing. Making the Global Infrastructure a Reality, (March 2003) Turner, Magill, Marples: Service Provision. Technologies for Next Generation Communications (April 2004) Welzl: Network Congestion Control: Managing Internet Traffic X (July 2005) Raz, Juhola, Serrat-Fernandez, Galis: Fast and Efficient Context-Aware Services X (April 2006) Heckmann: The Competitive Internet Service Provider (April 2006) Dressler: Self-Organization in Sensor and Actor Networks (November 2007) Berndt: Towards 4G Technologies: Services with Initiative (March 2008)

5 SERVICE AUTOMATION AND DYNAMIC PROVISIONING TECHNIQUES IN IP/MPLS ENVIRONMENTS Christian Jacquenet, Gilles Bourdon and Mohamed Boucadair All at France Telecom, France

6 Copyright # 2008 John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex PO19 8SQ, England Telephone (þ44) (for orders and customer service enquiries): [email protected] Visit our Home Page on All Rights Reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except under the terms of the Copyright, Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency Ltd, 90 Tottenham Court Road, London W1T 4LP, UK, without the permission in writing of the Publisher. Requests to the Publisher should be addressed to the Permissions Department, John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex PO19 8SQ, England, or ed to [email protected], or faxed to (þ44) Designations used by companies to distinguish their products are often claimed as trademarks. All brand names and product names used in this book are trade names, service marks, trademarks or registered trademarks of their respective owners. The Publisher is not associated with any product or vendor mentioned in this book. All trademarks referred to in the text of this publication are the property of their respective owners. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold on the understanding that the Publisher is not engaged in rendering professional services. If professional advice or other expert assistance is required, the services of a competent professional should be sought. Other Wiley Editorial Offices John Wiley & Sons Inc., 111 River Street, Hoboken, NJ 07030, USA Jossey-Bass, 989 Market Street, San Francisco, CA , USA Wiley-VCH Verlag GmbH, Boschstr. 12, D Weinheim, Germany John Wiley & Sons Australia Ltd, 42 McDougall Street, Milton, Queensland 4064, Australia John Wiley & Sons (Asia) Pte Ltd, 2 Clementi Loop #02-01, Jin Xing Distripark, Singapore John Wiley & Sons Canada Ltd, 6045 Freemont Blvd, Mississauga, ONT, L5R 4J3, Canada Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. Library of Congress Cataloging-in-Publication Data Jacquenet, Christian. Service automation and dynamic provisioning techniques in IP/MPLS environments / Christian Jacquenet, Gilles Bourdon and Mohamed Boucadair. p. cm. Includes index. ISBN (cloth : alk. paper) 1. MPLS standard. 2. TCP/IP (Computer network protocol) I. Bourdon, Gilles. II. BoucadaIr, Mohamed. III. Title. TK J dc British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library ISBN (HB) Typeset in 10/12 pt Times by Thomson Digital, India. Printed and bound in Great Britain by Antony Rowe Ltd, Chippenham, England. This book is printed on acid-free paper.

7 Contents Preface Acknowledgements xi xiii PART I ARCHITECTURES AND PROTOCOLS FOR SERVICE AUTOMATION 1 1 Introduction To Begin With On IP Networks in General, and Routers in Particular On the Usefulness of Dynamic Routing Protocols in IP Networks On the Inability of an IGP to Address Interdomain Communication Needs On the BGP-4 Protocol The Rise of MPLS Context and Motivation of this Book Classifying Capabilities Services and Policies The Need for Automation How this Book is Organized What Is and What Should Never Be 16 References 16 2 Basic Concepts What is a Policy? Deriving Policies into Rules and Configuration Tasks Instantiation Device Identification Translation Storing Policies Policy and Device Configuration Policy-based Management Model Reaching a Policy Decision Requirements for a PEP PDP Communication Protocol 24 References 25

8 vi Contents 3 The RADIUS Protocol and its Extensions Protocol Design Protocol Structure and Messages Forces and Weaknessess Authorization and Provisioning with RADIUS Radius Extensions EAP Support with RADIUS Interim Accounting Dynamic Authorization Using RADIUS for Assignment, Prioritization and Filtering with VLANs Filtering IP Traffic Future Extensions RADIUS and its Future 55 References 59 4 The Diameter Protocol Learning from RADIUS Deficiencies General Requirements Authentication Requirements Authorization Requirements Accounting Requirements Diameter is Born Diameter: Main Characteristics Diameter Network Entities Diameter Applications Sessions and Connections Diameter Routing Peer Discovery Peer Connection Maintenance for Reliable Transmissions Protocol Details Diameter Header AVP Format Command Codes Accounting Diameter Network Access Application (NASREQ) AVP Usage for NASREQ Enhanced Authorization Parameters Enhanced Authorization Examples Diameter Credit Control Application Diameter in NGN/IMS Architecture for QoS Control What is an NGN? QoS Control in ETSI/TISPAN Architecture 85 References 90

9 Contents vii 5 The Common Open Policy Service (COPS) Protocol A New Scheme for Policy-based Admission Control A Client Server Architecture The COPS Protocol The COPS Header The COPS Message Objects COPS Messages Client-Open (OPN) Client-Accept (CAT) Request (REQ) Decision (DEC) Other COPS Messages Summary of COPS Operations Use of COPS in Outsourcing Mode Use of COPS in Provisioning Mode On the Impact of Provisioning Mode on COPS Operations On the Impact of Provisioning Mode on PEP PDP Exchanges Security of COPS Messages 104 References The NETCONF Protocol NETCONF at a Glance Introduction Motivations for Introducing NETCONF NETCONF, an IETF Initiative Missions of the IETF NETCONF Working Group NETCONF-related Literature What is In? What is Out? NETCONF Protocol Overview Some Words about XML NETCONF Terminology NETCONF Layer Model NETCONF Communication Phases NETCONF Data NETCONF Capability Exchange RPC Layer NETCONF Filtering NETCONF Protocol Operations Retrieve Configuration Data Get Delete Configuration Data Copy Configuration Edit Configuration Data Close a NETCONF Session Kill a Session 143

10 viii Contents Lock NETCONF Sessions Unlock NETCONF Sessions Validate Configuration Data Commit Configuration Changes Discard Changes of Configuration Data NETCONF Notification Procedure NETCONF Transport Protocol NETCONF as Transport-independent Protocol Transport Protocol Alternatives NETCONF Capabilities URL Capability XPath Capability Writable-Running Capability Candidate Configuration Capability Confirmed Commit Capability Validate Capability Distinct Startup Capability Rollback on Error Capability Notification Capability Configuring a Network Device NETCONF Content Layer 173 References Control and Provisioning of Wireless Access Points (CAPWAP) CAPWAP to Address Access Point Provisioning Challenges CAPWAP Concepts and Terminology Objectives: What do we Expect from CAPWAP? CAPWAP Candidate Protocols The CAPWAP Protocol CAPWAP Future 186 References 186 PART II APPLICATION EXAMPLES OF SERVICE AUTOMATION AND DYNAMIC RESOURCE PROVISIONING TECHNIQUES Dynamic Enforcement of QoS Policies Introduction What is Quality of Service, Anyway? The Need for Service Level Specifications An Example Enforcing QoS Policies in Heterogeneous Environments SLS-inferred QoS Policy Enforcement Schemes Policy Rules for Configuring DiffServ Elements 197 References 198

11 Contents ix 9 Dynamic Enforcement of IP Traffic Engineering Policies Introduction Terminology Considerations Reference Model COPS Message Content Request Messages (REQ) Decision Messages (DEC) Report Messages (RPT) COPS-PR Usage of the IP TE Client-Type Scalability Considerations A Tentative Metric Taxonomy Reporting the Enforcement of IP Traffic Engineering Policy IP TE PIB Overview COPS Usage for IP TE Accounting Purposes 207 References Automated Production of BGP/MPLS-based VPN Networks Introduction Approach Use of Policies to Define Rules Instantiation of IP VPN Information Model Classes Policy Components of an IP VPN Information Model Physical Components of an IP VPN Information Model Virtual Components of an IP VPN Information Model Inheritance Hierarchy Dynamic Production of IP VPN Services Context of a Multidomain Environment A Bit of Terminology Reference Model Possible Extensions of the VPN Model 224 References Dynamic Enforcement of Security Policies in IP/MPLS Environments Enforcing Security Policies for Web-based Access Control Enforcing Security Policies in Companies with 802.1X 235 References Future Challenges Introduction Current Issues with Configuration Procedures Towards Service-driven Configuration Policies Towards the Standardization of Dynamic Service Subscription and Negotiation Techniques Basic Motivation Commercial Framework A Service-oriented Architecture 242

12 x Contents Publishing and Accessing Services Example of Automated IP VPN Service Composition Introducing Self-organizing Networks What is a Self-organizing Network? Characteristics of SON Networks and Devices On Self-management SON Algorithms and How to Use Them for Enhancing Dynamic Policy Enforcement Schemes SON-inferred Business Opportunities 249 References 249 APPENDICES 251 Appendix 1 XML Schema for NETCONF RPCs and Operations 253 Appendix 2 XML Schema for NETCONF Notifications 269 Appendix 3 Example of an IP Traffic Engineering Policy Information Base (IP TE PIB) 273 Appendix 4 Example of an IP TE Accounting PIB 297 Appendix 5 Description of Classes of an IP VPN Information Model 311 A5.1 Introduction 311 A5.2 Policy Class Definitions 311 Index 329

13 Preface Just remember the set of services offered by the Internet a few years ago s, web services, sometimes experimental voice services, over what used to be referred to as a highspeed connection of a few hundred kbits/second! The Internet has gone through a profound transformation and has been evolving at an unprecedented rate compared with other industries, thus becoming the central component of all forms of communication: data ( s, web services, search engines, peer-to-peer, e-commerce, stock trading, etc.), voice but also video (TV broadcasting, videoconferencing). New innovative applications and services will undoubtedly continue to emerge, and we are still at an early stage of what the Internet will be able to provide in the near future. With no doubt, the impact of the Internet on how people communicate around the world and access to information will continue to increase rapidly. New forms of communication will arise such as tele-presence, ubiquitous services and distributed gaming, and the Internet will ineluctably extend its reach to objects, which is sometimes referred to the Internet of things, with billions of objects interconnected with each other and new forms of machineto-machine communication. This new era of services will lead to endless possibilities and opportunities in a variety of domains. The offering of a wide range of new services has required the design of networking technologies in the form of sophisticated protocols and mechanisms based on open standards driven by the Internet Engineering Task Force (IETF). The non-proprietary nature of the Internet Protocol (IP) led to interoperable solutions, thus making the Internet a unique platform of innovation. As a direct implication of the Internet becoming critical to our personal and professional lives, user expectation has become very high in terms of reliability, quality of service (QoS) and security. A network failure of a few minutes is now considered as unacceptable! Fast network failure detection and traffic reroute mechanisms have been designed to find alternate paths in the network within the timeframe of a few milliseconds while maintaining path quality. Fine granularity in terms of QoS is now a must: although some applications are inherently delay tolerant (e.g. asynchronous communications such as s), other traffic types impose bounded delays, jitters and reliability constraints that require complex configuration tasks to engineer the network. QoS guarantees imply traffic classification at the edge of the network, sophisticated local forwarding techniques (multipriority scheduling and traffic discard) and traffic engineering. The ability to effectively engineer the traffic within the network is now of the utmost importance and is known as a fairly difficult task for service providers considering the high

14 xii Preface volume of varying traffic. Furthermore, service providers have to engineer the network carefully in order to meet the quality of services imposed by demanding applications while having to deal with resource constraints. Security has become a central component: user identification and authentication and protection against attacks of different forms, including denial of service (DoS) attacks, require the configuration of complex networking technologies. Last but not least, the ability to efficiently manage and monitor the network is an absolute requirement to check service level agreements, enforce policies, detect network faults and perform network troubleshooting to increase the network availability. A considerable amount of attention has been paid to service automation, network provisioning and policy enforcement. Network technology designers have been actively working on various tools to effectively provision, configure and monitor the network with sophisticated network components so as to ensure the toll quality that the Internet is now delivering, far from the best effort service of the early days of the Internet. These tasks are increasingly crucial and complex, considering the diversity of the set of services provided by the Internet and the scale at which such tasks must be performed, with hundreds of millions of end-users, hundreds of services and a very significant traffic growth. This is the right book at the right time, and the authors are known for their deep level of expertise in this domain. The organization of the book is particularly well suited to the topic. The first part examines the protocols and architecture required for network provisioning and policy enforcement in IP/MPLS networks. However, a book on this key subject would not be thorough without a strong emphasis on issues of a practical nature, and this is what the second part of the book is about. A number of highly relevant examples are provided on QoS, traffic engineering and virtual private networks, ideally complementing the theory expounded in the first part of the book. JP Vasseur Cisco Distinguished Engineer Chair of the IETF Path Computation Element Working Group

15 Acknowledgements Christian Gilles Mohamed To my wife Béatrice and my sons Pierre and Paul, with all my love To my wife and my son To my parents and my wife, with all my love